Upgrade ASA an Active/Standby Failover Pair Using the CLI

Upgrade ASA an Active/Standby Failover Pair Using the CLI

- in Security

In this tutorial, we will update two ASA firewall 5585-X from CLI.

Actual version
Target version

Note: Perform these steps on the active unit

Step 1 – On the active unit in privileged EXEC mode, copy the ASA software to the active unit flash memory:

asa/pri/act# copy ftp://MyUser:MyPassword@ disk0:/asa984-44-smp-k8.bin

Step 2 – Copy the software to the standby unit; be sure to specify the same path as for the active unit:

asa/pri/act# failover exec mate copy /noconfirm ftp://MyUser:MyPassword@ disk0:/asa984-44-smp-k8.bin

Step 3 – Access global configuration mode:

asa/pri/act# configure terminal

Step 4 – Show the current boot images configured:

asa/pri/act(config)# show running-config boot system
boot system disk0:/asa984-20-smp-k8.bin
boot system disk0:/asa964-36-smp-k8.bin

Step 5 – Remove any existing boot image configurations so that you can enter the new boot image as your first choice:

asa/pri/act(config)# no boot system disk0:/asa984-20-smp-k8.bin
asa/pri/act(config)# no boot system disk0:/asa964-36-smp-k8.bin

Step 6 – Set the ASA image to boot and save the new settings to the startup configuration::

asa/pri/act(config)# boot system disk0:/asa984-44-smp-k8.bin
pri/act(config)# write memory
Building configuration…
Cryptochecksum: a54401f5 14357f54 e3455251 eb1a3ef0

129373 bytes copied in 1.330 secs (129373 bytes/sec)

These configuration changes are automatically saved on the standby unit.

Step 7 – Reload the standby unit to boot the new image: 

asa/pri/act(config)# failover reload-standby

In the Standby unit will appear this message:

Wait for the standby unit to finish loading. The Active unit will display a message that the firmware version does not match:

Use the show failover command to verify that the standby unit is in the Standby Ready state.

Step 8 – Force the active unit to fail over to the standby unit.

asa/pri/act(config)# no failover active

If you are disconnected from your SSH session, reconnect to the main IP address, now on the new active/former standby unit.

Step 9 – From the new active unit, reload the former active unit (now the new standby unit).

asa/sec/act(config)# failover reload-standby

Step 10 -Lastly, validate with the show failover command that versions be the same on both ASA:




Facebook Comments

You may also like

What is a network and its components?

A computer network is a group of computers